mirror of
https://github.com/anchore/syft.git
synced 2025-11-17 08:23:15 +01:00
2a7325a965
* Fix CPE generation when the generated CPE contains invalid characters Currently syft seems to generate invalid CPEs which do not conform with the official CPE spec. This is because the underlying nvdtools library is not a completely spec compliant implementation and has some interesting bugs/issues. The following are the list of issues I have encountered with nvdtools: 1. It parses strings which are not CPEs incorrectly as valid CPEs. This messes up our filter function which is supposed to filter out any incorrect CPEs we generate. In order to fix this, I have introduced a new regex in the NewCPE function which follows the upstream spec and filters out any incorrect CPEs. 2. Introduce wfn.WFNize for any cpe attributes we infer from packages. This ensures that we are escaping and quoting any special characters before putting them into CPEs. Note that nvdtools has yet another bug in the WFNize function, specifically the "addSlashesAt" part of the function which stops the loop as soon as it encounters ":" a valid character for a WFN attribute after quoting, but the way nvdtools handles it causes it to truncate strings that container ":". As a result strings like "prefix:1.2" which would have been quoted as "prefix\:1.2" end up becoming "prefix" instead causing loss of information and incorrect CPEs being generated. As a result in such cases, we remove out strings containing ":" in any part entirely for now. This is similar to the way we were handling CPE filtering in the past with http urls as vendor strings 3. Add special handling for version which contain ":" due to epochs in debian and rpm. In this case, we strip out the parts before ":" i.e. the epoch and only output the actual function. This ensures we are not discarding valid version strings due to pt #.2. In the future we should look at moving to a more spec compliant cpe parsing library to avoid such shenanigans. Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net> * Remove WFNize for input strings WFNize seems to not be part of the standard as per https://pkg.go.dev/github.com/facebookincubator/nvdtools@v0.1.4/wfn#WFNize and seems to have bugs/issues with encode/decode cycles, so I am just removing it at this point and relying on the CPE regex to filter out invalid CPEs for now. Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net> * Quote the string on decode to ensure consistent CPE string generation Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net> * Add test cases for round-tripping the CPE and fix strip slashes Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net> * Add comprehensive tests for cpe parsing Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net> * Use strings.Builder instead of byte buffer Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
46 lines
1.0 KiB
Go
46 lines
1.0 KiB
Go
package spdxhelpers
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/anchore/syft/internal/formats/spdx22json/model"
|
|
"github.com/anchore/syft/syft/pkg"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func Test_ExternalRefs(t *testing.T) {
|
|
testCPE := pkg.MustCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*")
|
|
tests := []struct {
|
|
name string
|
|
input pkg.Package
|
|
expected []model.ExternalRef
|
|
}{
|
|
{
|
|
name: "cpe + purl",
|
|
input: pkg.Package{
|
|
CPEs: []pkg.CPE{
|
|
testCPE,
|
|
},
|
|
PURL: "a-purl",
|
|
},
|
|
expected: []model.ExternalRef{
|
|
{
|
|
ReferenceCategory: model.SecurityReferenceCategory,
|
|
ReferenceLocator: pkg.CPEString(testCPE),
|
|
ReferenceType: model.Cpe23ExternalRefType,
|
|
},
|
|
{
|
|
ReferenceCategory: model.PackageManagerReferenceCategory,
|
|
ReferenceLocator: "a-purl",
|
|
ReferenceType: model.PurlExternalRefType,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
assert.ElementsMatch(t, test.expected, ExternalRefs(test.input))
|
|
})
|
|
}
|
|
}
|